How DusitD2 attack was executed

A section of Dusit D2 hotel in Nairobi on Riverside drive. [Edward Kiplimo,Standard]

The masterminds of the DusitD2 Hotel terror attack on January 15, 2019, made 140 calls to execute their plan.

Documents filed by the government before the International Court of Justice (ICJ) outlined how the attack was planned, the terrorists’ movements, their roles, and the escape of one of the key operatives, Violet Wanjiru, alias Kemunto, back to Somalia.

The DusitD2 attack was carried out on a significant date, coinciding with the third anniversary of al-Shabaab’s overrunning of a Kenya Defence Forces (KDF) base in El Adde, Gedo region.

In its plea before the court urging it to deny Somalia’s claim to territorial waters, Kenya listed terrorism as among the reasons its citizens are at risk.

For the first time, Kenya has meticulously detailed how the plan started with 22 calls from a number in Somalia to the suicide bomber, Mahir Khalid Riziki, who would then travel from Somalia to El Wak town on January 11, 2019.

Riziki, who was born on February 5, 1993, in Majengo, Mombasa, was the longest-serving member of al-Shabaab in the attack group and was designated as the suicide bomber.

In 2014, he is said to have formed an assassination cell in Mombasa, which was tasked by the militant group to assassinate security personnel.

Court documents show that the man was involved in the killing of a police officer at Royal Court Hotel in Mombasa in October 2014 before he fled to Tanzania a month later.

The State then traced him to Somalia in 2015 when he called his family and informed them that he was undergoing training by al-Shabaab.

Religious violence

The government says he was radicalised in a Mombasa mosque that has long been associated with radicalisation, recruitment for al-Shabaab and religious violence.

On January 11, 2019, he crossed into Kenya and activated a Kenyan phone registered in the name of ‘Hibo Ahmed’ that morning, and immediately placed a call to Somalia.

At 6.21pm, Riziki placed his first call to the man who became the DusitD2 second attacker, as well as his cell leader, Ali Salim Gichunge. He then arrived at the safe house in Muchatha, Kiambu, later in the evening.

“Except for his Somali contact and Gichunge, Riziki placed calls to only one other number from the time he entered Kenya until his death four days later, thereby limiting his exposure to Kenyan security forces,” the government said.

He exchanged 11 phone calls with Gichunge, including a final 91-second call at 15:25pm.

Riziki blew himself up while standing outside Secret Garden restaurant within the DusitD2 complex in Nairobi.

The government says Gichunge managed to escape security officers’ radar for long as he only communicated with his Somalia contacts online, and would switch off his mobile phone whenever he met with his associates.

“Gichunge was highly conscious of the security of communications; for instance, he never contacted Somalia by phone – only using Facebook – turned his phone off when he travelled to meet associates, and spoke to Riziki only on a dedicated phone line.”

He communicated with al-Shabaab co-ordinators in Jilib, Somalia. He was also the link to funds used to organise the attack and the money came from al-Shabaab operatives based in Mandera.

The co-ordinator in Mandera is identified as Yussuf Ali Adan in the court filings.

On January 2, 2019, the second attacker Osman Ibrahim Gedi registered a new mobile phone in the name of ‘Abdikadir Mohamud Sabdow’.

He arrived in Nairobi early on January 4, 2019. However, an analysis of Gedi’s mobile phone communications did not show any contact with Somalia.

Kenyan investigators recovered a Tanzanian driver’s licence from Gedi’s body. Investigations indicated that the licence was genuine and had been registered in Moshi. However, the biographical details provided in the application proved to be false, and the fingerprint used to obtain the licence did not match Gedi’s.

There is another unknown attacker who made 81 calls to and from Somalia. He, alongside Mayat Omar Abdi, travelled from Dadaab to Muchatha.

The mystery person, presumed to be of Somali origin, activated a Kenyan number in Dagahaley, Dadaab refugee camp, on December 15, 2018. Two days later, he travelled from Dagahaley to Eastleigh in Nairobi. The journey took eight hours. It is believed he travelled in a private vehicle.

He hid in Eastleigh until January 12, 2019 when he established contact with Gedi, after which he moved to Nairobi on January 13. He spoke no English or Kiswahili.

Mayat was born in 1992 in Dagahaley, one of the Dadaab refugee camps. He had 37 calls on his mobile number from Somalia. He activated a new Kenyan phone number on January 4, 2019 in preparation for the attack and travelled to Nairobi from Dagahaley the next day.

Terror plot

The phone immediately placed a call to Somalia after its activation. Mayat continued to contact numbers in Somalia until January 14, 2019, when the phone was last used.

The last figure in the terror plot is Violet Wanjiru. Authorities say she is also known as Kemunto or Khadija. She married Gichunge in 2016 and her primary role was to manage the safe house in Muchatha.

According to the government, she was unaware of the suicidal nature of the impending attack. She is said to have believed Gichunge would later flee to Somalia to join her.

“Wanjiru’s inside knowledge of the Al-Shabaab cell meant it was vital to Al-Shabaab that she not be arrested,” documents read.

She left Muchatha on January 11, 2019, and travelled through Wajir and El Wak to Mandera, arriving the same day. Wanjiru was in Mandera until January 14 when she crossed into Somalia.

She was aided by Adan, the Mandera operative, with whom she communicated on a newly activated phone line. Wanjiru was housed in the border region in a safe house under al-Shabaab control for a number of weeks before being moved further into their territory and into isolation to observe Iddah, a period of mourning following the death of a husband.

Kenya says it does not know her whereabouts from there.

Investigators got crucial leads upon searching a Toyota Ractis KCE 340E, which led them to the house of the attackers and all those they either interacted or transacted with prior or during the attack.

Investigators got Gichunge’s ID number - 30187055 - which led them to three mobile phone numbers.

From Wanjiru’s ID – 29733620 – they got six mobile phone numbers.

They then traced the calls these phones made to numbers in Somalia.